PT-2026-118034

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud getFileURL Endpoint Leads to Remote Denial of Service in github.com/luskaner/ageLANServer/server...

GHSA-4JFQ-PMQ9-257H ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...